Veracode Vulnerability DatabaseVERACODE:46567Denial Of Service (DoS)
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
6.6 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
15.7%
libapache2-mod-auth-openidc is vulnerable to Denial Of Service (DoS). The vulnerability is due to missing input validation on the mod_auth_openidc_session_chunks cookie value and the server struggling with requests for a long time and eventually returning a 500 error when the value of the cookie is manipulated to a very large integer, such as 99999999. It allows attackers can make the server unresponsive or crash with minimal effort.
| CPE | Name | Operator | Version |
|---|---|---|---|
| libapache2-mod-auth-openidc:sid | eq | 2.4.4.1-1 | |
| libapache2-mod-auth-openidc:sid | eq | 2.4.4.1-1 |
References
github.com/OpenIDC/mod_auth_openidc/commit/4022c12f314bd89d127d1be008b1a80a08e1203d
github.com/OpenIDC/mod_auth_openidc/security/advisories/GHSA-hxr6-w4gc-7vvv
lists.debian.org/debian-lts-announce/2024/03/msg00004.html
lists.fedoraproject.org/archives/list/[email protected]/message/T7DKVEVREYAI4F46CQAVOTPL75WLOZOE/
security-tracker.debian.org/tracker/CVE-2024-24814
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
6.6 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
15.7%